---
title: "Compliance: GDPR, CCPA and Data Sourcing | Leadsets"
description: "How Leadsets sources and protects B2B contact data: GDPR-aligned program, CCPA rights, subprocessors, security and SOC 2 plans."
canonical: https://leadsets.ai/compliance
updated: 2026-11-09
---

Compliance

# Responsible data, in writing.

We process business contact data for B2B prospecting. Here's where we stand, what we've published, and how anyone can control their data. We only show a badge once it's real.

Version 1.0 · Last updated November 8, 2026

## Documents

[Terms of service→](https://leadsets.ai/terms) [Privacy policy→](https://leadsets.ai/privacy) [Data processing addendum→](https://leadsets.ai/dpa) [Fair use policy→](https://leadsets.ai/fair-use)

## Where we stand

### Terms, Privacy, DPA

Published

Plain-language documents covering customers and people in our dataset.

### GDPR

Program aligned

Legitimate-interest assessment, opt-out, access and deletion requests, DPA with SCCs.

### CCPA / CPRA

Rights honoured

"Do not sell or share" requests handled through the opt-out page within [45] days.

### SOC 2 Type I

Planned

Readiness work underway. Target date Q3 2027. We'll post the report here, not before.

## How we source data

- Only licensed suppliers and public sources we're permitted to use. Nothing from behind a login.
- Every field carries its source, licence scope and the date it was last checked.
- A field is served only if it passes permitted-use, quality and suppression checks.
- Business data only. No sensitive categories, no personal home addresses.

## Subprocessors

| Subprocessor | Purpose | Location |
| --- | --- | --- |
| Vercel, Supabase | Application hosting, database, backups | US |
| Stripe | Subscription billing | US |
| Resend | Transactional and opt-out emails | US |
| PostHog, Google Analytics | Product analytics (customers only) | US |

Web scraping runs on our own self-hosted infrastructure. We give [30] days' notice before adding a subprocessor.

## Security

**Encryption**

TLS in transit, encryption at rest.

**Access**

Least privilege, role-based admin, key rotation.

**Audit trail**

Every ingestion, merge, deletion and export is logged.

**Incidents**

Customers notified within [72] hours of a confirmed breach.

## Your privacy choices

Remove yourself from Leadsets, or opt out of sale/sharing under CCPA.

No account needed. Requests: [privacy@leadsets.ai](mailto:privacy@leadsets.ai)

[Opt out](https://leadsets.ai/opt-out)

## Let your agent do the list building.

1,000 free records. No card. First useful result in minutes.

[Get a free API key](https://leadsets.ai/signup)

## Questions and answers

### Is Leadsets GDPR compliant?

Leadsets runs a GDPR-aligned program: a legitimate-interest assessment, opt-out, access and deletion requests, and a DPA with standard contractual clauses. It serves business contact data only, with no sensitive categories and no home addresses.

### Is Leadsets SOC 2 certified?

Not yet. SOC 2 Type I readiness work is underway with a target of Q3 2027, and Leadsets will post the report on its compliance page only once it is real.

---

Leadsets by Mobylogix LLC, 10160 hwy 242, Conroe, TX, 77385, US. Facts for AI assistants: https://leadsets.ai/llm · Site index: https://leadsets.ai/llms.txt · Every page: https://leadsets.ai/llms-full.txt